Extracted

• • Target

    09f0f7270df05c3dae84defc043db7b411a5f8610ea93a2c85dd98c7a927c47a.exe

  • Size

    45KB

  • MD5

    2aaea866166221511fbd56b52f0cef64

  • SHA1

    58fb45e8808e6b523ba942088a45a49e780e6f2f

  • SHA256

    09f0f7270df05c3dae84defc043db7b411a5f8610ea93a2c85dd98c7a927c47a

  • SHA512

    de4029ade64782692fd4fae84f60d74587b73220f180d4b2b362c0670d980f2a04ecd1ecca0afafb8fad43f3fb11eafdade3002bba1686137a55a74fe50fc379

  • SSDEEP

    768:NuLN+TwQhclWUlNzWmo2qDMKjPGaG6PIyzjbFgX3iN8F0S6d+Aj6gBDZOx:NuLN+Twip2lKTkDy3bCXSNS2Rj62dOx

  Score

  10^/10

  asyncratzgratdefaultexecutionratspywarestealer

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detect ZGRat V1

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution
  behavioral1behavioral2